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Fight from the inside: 
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Why Cloud Agent? 


SIEMENS 
Ingenuity for ufe 

Fight from the inside — unauthenticated 
is not enough 


But... 
e Authenticated scans and password 
life cycle are a nightmare 
1.5k providers and administrators 


e Psychology — Humans don't want to 
give away control 
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Cloud Agent: Lessons learned 


It's mostly about politics 
Management support 
Communication is vital 
Make friends at an early stage 
Implement a showcase 
Be prepared to answer any question 
Have a lab environment ready 
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Cloud Agent: Lessons learned SIEMENS 
Ingenuity for Life 
+ Needs a dedicated project 
+ Plan for disaster 
> Establish a human network 


+ Track and trace 
+ Communication is vital 
+ Be as supportive as possible 
> Hey Qualys: can you say MSI? 


+ End of project doesn't mean you are done 
> License costs are not the point! 
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Findings SIEMENS 
Ingenuity for Life 


Don't panic! 
+ Sit down and have a cup of tea first! 
+ Your standard process will probably be not enough 


Don’t get lost in the details! 
+ Visualize & identify patterns - Pivot is your friend 
+ Explain them — to management! 
> Fix it! 
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Cloud Agent: Lessons learned SIEMENS 
Ingenuity for Life 


Some things you might discover: 

* Some have no patch process at all 

+ Don't control their patch process 

> Gave away the keys - no clue who installed what and why 

> Have no support contracts and thus no access to patches 

e Decommissioned machines are just abandoned and run on their own 
+ Systems are installed with ‘all in’ 

e Maintenance windows are to short 

+ Skills and resources can be a problem 
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Vulnerability Remediation: 3 Strikes Approach SIEMENS 
Ingenuity for Life 
1. Low hanging Fruits on application layer 
+ Remove unnecessary software, e.g. Adobe Reader, Flash, Firefox, Office... 


2. OS layer: 
+ Get all the latest patches from the OS vendor, 
install and verify successful installation 


Low 
hanging ff patches 


Fruits 
3. Applications: 


+ Get all the latest patches from the application vendor(s) , 
install and verify successful installation 


Application 
Patches 


Implement a regular, periodic process for the above steps — 
be pro-active not reactive! 


Unrestricted O Siemens AG 2018 
Page 7 December 2018 


Passive Resistence SIEMENS 
Ingenuity for ufe 


+ Address people directly 
e Leverage your human network 


> Your systems are at the top 100 worst of the company 
> BUT WE CAN CHANGE THAT — TOGETHER! 
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How Qualys could help 


+ Self healing agents 

e Better debugging capabilities 

e More transparency 

e More revision control — manifest control 
+ Provide MSI packages 
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Thank you for your attention! 
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Contact page SIEMENS 
Ingenuity for Life 


Michael Seeger 


Siemens AG 
Cybersecurity 
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AL 2 Mobile: +49 (173) 3758028 
vl Will E-mail: Michael.Seeger@siemens.com 
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